The Five-Minute Technology Audit: What Every Board Should Demand From Its CIO
Photo: corporate board meeting executives reviewing documents modern office, via images.stockcake.com
Board members routinely interrogate financial statements, audit findings, and market exposure. Yet the enterprise technology estate — often the largest capital commitment after people and property — is governed on vibes. The quarterly IT update arrives as a slide deck of green status indicators, and everyone moves on.
This article offers a corrective: five questions, answerable in roughly five minutes, that cut through the dashboard theater. Each includes why it matters, what a strong answer sounds like, and the red flags that should prompt a deeper look. Forward it to your leadership team as a self-assessment. The gaps in the answers will tell you more than any vendor briefing.
1. What Percentage of Our IT Spend Funds New Capability Versus Keeping the Lights On?
Why it matters. This ratio is the single best proxy for whether technology is a growth engine or a maintenance burden. Industry benchmarks put run-the-business spend between 60 and 80 percent at typical American enterprises; world-class operators push below 60.
A good answer sounds like: a specific, current figure, trended over several quarters, with a stated target and a plan attached.
Red flags: "We're working on getting that visibility." An inability to answer this question is itself the finding — it means the technology portfolio is not managed as a portfolio at all.
2. Which Single Vendor Could Halt Our Operations Tomorrow?
Why it matters. Concentration risk in software procurement behaves like concentration risk in investing: invisible until it is catastrophic. Licensing structures, proprietary data formats, and cloud dependencies can convert one vendor relationship into a single point of enterprise failure.
A good answer sounds like: a named vendor, a quantified exposure, a documented contingency, and evidence the contingency has been tested.
Red flags: more than three vendors named without exit plans, or — worse — a long pause. Enterprises that cannot name their dependency have usually stopped looking for it.
3. If a Core System Failed Tonight, How Long Until We Recover — and When Did We Last Prove It?
Why it matters. Disaster recovery documents are written in calm conference rooms and executed in panic. The gap between the recovery time objective on paper and the recovery time in practice is where outages become existential.
A good answer sounds like: a stated RTO and RPO per critical system, paired with the date of the last full-scale test and what that test revealed.
Red flags: answers that reference documentation rather than testing. A plan that has never been rehearsed is a hypothesis, not a capability.
4. How Much of Our Critical Business Logic Lives Outside Our Systems of Record?
Why it matters. Spreadsheets, personal scripts, and unsanctioned tools absorb enterprise logic that architecture diagrams never show. When the person who built the workbook retires, the business process retires with them. This is an architectural governance question disguised as a housekeeping one.
A good answer sounds like: an inventory effort with named ownership, a triage of which spreadsheets are actually load-bearing, and a roadmap for the ones that matter.
Red flags: "None that we know of." Every enterprise has them; the ones that claim otherwise simply have not audited.
5. What Did We Learn From Our Last Three Technology Failures — and Where Is That Written Down?
Why it matters. Enterprises do not repeat mistakes because they lack intelligence; they repeat them because post-incident knowledge lives in the memories of the people involved, not in institutional systems. When those people move on, the tuition paid for each failure is wasted.
A good answer sounds like: specific incidents, specific changes made as a result, and a repository where those decisions are documented and discoverable by teams who were not in the room.
Red flags: vague references to "lessons learned" without artifacts. If the answer requires calling someone to remember, the organization is paying for the same education twice.
Using the Audit
The power of these questions is not in the answers themselves but in the speed and specificity with which they arrive. A technology organization that can answer all five in five minutes, with numbers and dates, is almost certainly well-governed. One that needs six weeks and a working group to respond has told you everything you need to know.
Boards do not need to become technologists. They need to become better questioners — and to insist that the people accountable for the enterprise's largest operational estate can answer, quickly and honestly, when asked.
